So you don’t want to have to type a password everytime you login via ssh to a remote machine? Or you have a script that needs to connect via ssh to a remote machine and you don’t want to have to be there to type in the password? Well, you might want to use a public/private key to authenticate rather than a password.

Lets get the terminology straight. For the purposes of this discussion, we will call the machine you want to login to the “server”. The machine you are logging in from (without a password) is the “client”.

In order for this to work you must have an account on both machines. Be sure to work on the accounts that you will be loging in to and from respectively.

1. On the client: ssh-keygen -t dsa
2. hit “enter” to accept the default file location
3. hit “enter” twice to proceed without a password
4. Take note of where your public key was saved, then go there
5. Copy the contents of id_dsa.pub
6. On the server cd ~/.ssh/
7. Open the file called “authorized_keys” (create it if necessary)
8. Paste the contents of id_dsa.pub into this file, then save the file
9. Done! You should be able to login via ssh from the client to the server without a password

Gotchas and discussion:

• dsa seems to be a solid choice for encryption type, over for instance, rsa. However, I’m not an expert, so you should satisfy yourself as to the right choice
• The whole point of this is to avoid having to enter a password, so I don’t enter a password to protect my keys. Only do this if you feel confident that your private key will be safely under your control.
• I used “copy” and “paste” in my instructions to try to cater to the less experienced users. If you would rather do things like cat id_dsa.pub >> ~/.ssh/authorized_keys then go for it.
• Make sure you don’t introduce return characters (line breaks) into authorized_keys by mistake. The whole key is supposed to be two lines, like this:
  ssh-dss
AAAAB3NzaC1kc3MA ..............(lots more)

This entry was posted on Sunday, June 26th, 2005 at 1:21 pm and is filed under Linux, Macs. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.